Take the State of DFIR Survey

Caseloads, AI, tools and careers. 8 minutes, anonymous, early access to the report.

Take the survey →
19th October 2026

Investigating WMI Permanent Event Subscription Persistence
Hero Image

Vitalii offers a hands-on DFIR deep dive into WMI ActiveScriptEventConsumer persistence, from registration and execution to memory artifacts, Sigma detection, and cleanup....

Read More

Today's headlines 20 Oct 2026

More news →

Atola TaskForce Gets A Massive Update Including A New Compare Module

Atola TaskForce Gets A Massive Update Including A New Compare Module

19th October 2026

Meet Atola TaskForce firmware 2026.10, featuring a brand-new sector-by-sector Compare module, detection of used-drive fraud on Seagate devices, enhanced Web API automation, and 30+ improvements across forensic imaging workflows....read more

Forensic Focus Digest, 16 Oct 2026

Forensic Focus Digest, 16 Oct 2026

16th October 2026

Discover what’s new on Forensic Focus: explore how the City of Johannesburg uses Detego Global to accelerate investigations, see how MD-LIVE takes investigators from first connection to a court-ready report, learn how iVe analyzes vehicle data to reveal driver behavior, and more....read more

The Forensic Focus State Of DFIR Survey Is Now Open

The Forensic Focus State Of DFIR Survey Is Now Open

15th October 2026

Caseloads, AI, tools, hiring and careers: tell us what DFIR work looks like today. About 8 minutes, anonymous, with early access to the report...read more

Amped Replay Update 15666: Further Intuitive Annotation And Enhancement Tools

Amped Software announced the release of another update to Amped Replay, the enhanced video player for investigators, frontline officers, first responders, security personnel and CCTV operators to conduct a quick first level analysis of their video, with easy conversion, correction,

Cut Your Imaging Time In Half With FTK® Imager 4.3

When it comes to forensics, speed is king and the latest release of FTK® Imager, version 4.3 is all about speed; cutting imaging time in half.The faster you preserve the data, the quicker analysis can begin. To achieve this speed

Digital Forensic Challenges In Major Case Law And Global Legislation

Christa: Hello and welcome to the Forensic Focus podcast. Monthly we interview experts from the digital forensics and incident response community on a host of topics ranging from technical aspects to career soft skills. I’m your host, Christa Miller. With

Digital Forensic Challenges In Major Case Law And Global Legislation

Christa: Hello and welcome to the Forensic Focus podcast. Monthly we interview experts from the digital forensics and incident response community on a host of topics ranging from technical aspects to career soft skills. I’m your host, Christa Miller. With

Learn Real-World Scenarios With Basic Forensic Investigations Training

Staying up to date with the most current topics and real-world scenarios in forensics is daunting and overwhelming. That’s why BlackBag’s Basic Forensic Investigations course is a must for investigators, regardless of prior use of BlackBag’s tools.BlackBag’s team of expert

What’s Happening In Forensics – Feb 4, 2020

ElcomSoft’s Vladimir Katalov discusses Apple vs. law enforcement. Gerald Beuchelt talks about deanonymising Tor circuits. DFRWS announce a Women In Forensic Computing workshop day ahead of the main EU conference in March.

What’s Happening In Forensics – Feb 3, 2020

Jessica Hyde shares a brief guide to getting started in digital forensics. Haniah Shafi discusses Android Auto and Apple CarPlay forensics. Matthew Seyer releases a tool to help investigators reformat and filter JSONL.

Shining A Light On Spotlight

Mark Scanlon discusses his student's research at DFRWS EU 2019. OK, good morning, how are you doing? My name is Mark Scanlon, I’ve been speaking to some of you guys already. I’m from University College Dublin. This work was primarily

Take It Or Leave It: Triaging Digital Evidence

Have you ever served a search warrant and stared at the mountainous amount of digital media collected and wondered how much is actually related to your investigation? Or, have you had to undertake terabytes of storage media and wondered if

What’s Happening In Forensics – Jan 29, 2020

Errata Security discuss how to decrypt WhatsApp end-to-end media files. The HTCIA 2020 call for presentations is now open. Linux Security Labs share a review of GRR Rapid Response. Rick Holland recaps the SANS Cyber Threat Intelligence Summit 2020.

Amped Authenticate Update 15518: Customizable Reporting, Sun Position And More

Amped Software just released another update to Amped Authenticate, the leading forensic software for digital forensic experts to exploit the data behind digital images, allowing analysis of image integrity, authenticity, metadata, source and history, and detection of tampering prior to

What’s Happening In Forensics – Jan 28, 2020

Andrea Fortuna shares some thoughts on the Jeff Bezos phone hack data. Ciarán O’Brien provides a triage script to help with retrieving artifacts from compromised Citrix hosts. Magnet discuss how their new AXIOM Cyber tool can help with employee misconduct

What’s Happening In Forensics – Jan 27, 2020

Adam Harrison discusses evidence of program execution on different Windows OS versions. Magnet release AXIOM Cyber for remote acquisitions. Foxton Forensics discover some differences between Chromium and Edge Chromium artifacts. Andrew Hoog unpicks NavdDoomConductor, which tracks precise geolocation and time